F5: web search/fetch on the Kimi services (kimi-cli parity)

web_search now speaks the Kimi search service (kimi-cli tools/web/search.py,
wire-verified against api.kimi.com):
- POST {coding_base}/search with {text_query, limit 1-20 (default 5),
  enable_page_crawling, timeout_seconds: 30}, OAuth bearer +
  X-Msh-Tool-Call-Id; results render in kimi-cli's Title/Date/URL/Summary
  schema with result URLs as citations.
- The old implementation called the xAI Responses API with a search model;
  that client is fully replaced and the entire model-based config surface
  is excised root-and-branch: web_search_model config keys/env/CLI plumbing,
  resolve_web_search_sampling_config, toolset web_search SamplerConfig,
  RemoteSettings.web_search_model, default_web_search_model.
- Enablement is now purely structural: the service exists only on the Kimi
  Code subscription channel, so OAuth sessions get Enabled and API-key-only
  sessions get Disabled (tool absent) — per PRD F5.

web_fetch gains the Kimi fetch service as its primary path (kimi-cli
tools/web/fetch.py): POST {coding_base}/fetch with {url}, Accept:
text/markdown, OAuth bearer + X-Msh-Tool-Call-Id; the 200 body is the
extracted markdown (still overflow-budgeted). Any service failure falls
back to the existing local pipeline (SSRF guards, cache, extraction).
The tool gate defaults ON now (kimi-cli always offers FetchURL) and the
egress User-Agent no longer claims grok-agent/x.ai.

Verified end-to-end against the scripted mock service: a headless session
drove web_search (limit/crawling/call-id observed on the wire) then
web_fetch (Accept + call-id observed) to completion.

crates/codegen/kigi-shell/src/session/acp_session_impl/spawn.rs

@@ -148,7 +148,7 @@ pub(crate) async fn spawn_session_actor(
     session_client_identifier: Option<String>,
     inference_idle_timeout_secs: u64,
     max_retries: Option<u32>,
-    web_search_sampling_config: Option<kigi_sampler::SamplerConfig>,
+    web_search_config: kigi_tools::implementations::WebSearchConfig,
     web_fetch_config: kigi_tools::implementations::grok_build::web_fetch::WebFetchConfig,
     image_gen_config: kigi_tools::implementations::grok_build::image_gen::ImageGenConfig,
     video_gen_config: kigi_tools::implementations::grok_build::video_gen::VideoGenConfig,
@@ -341,22 +341,8 @@ pub(crate) async fn spawn_session_actor(
     let primary_model_id = sampling_config.model.clone();
     let web_search_config = if disable_web_search {
         kigi_tools::implementations::WebSearchConfig::Disabled
-    } else if let Some(cfg) = web_search_sampling_config {
-        if let Some(api_key) = cfg.api_key {
-            kigi_tools::implementations::WebSearchConfig::Enabled {
-                api_key,
-                base_url: cfg.base_url,
-                model: cfg.model,
-                extra_headers: cfg.extra_headers,
-                alpha_test_key: credentials.alpha_test_key.clone(),
-            }
-        } else {
-            tracing::warn!("web_search disabled: resolved config has no API key");
-            kigi_tools::implementations::WebSearchConfig::Disabled
-        }
     } else {
-        tracing::warn!("web_search disabled: configured model could not be resolved");
-        kigi_tools::implementations::WebSearchConfig::Disabled
+        web_search_config
     };
     let embed_base_url = sampling_config.base_url.clone();
     let embed_api_key = sampling_config.api_key.clone();
@@ -1597,7 +1583,7 @@ pub(crate) async fn spawn_session_on_thread(
     session_client_identifier: Option<String>,
     inference_idle_timeout_secs: u64,
     max_retries: Option<u32>,
-    web_search_sampling_config: Option<kigi_sampler::SamplerConfig>,
+    web_search_config: kigi_tools::implementations::WebSearchConfig,
     web_fetch_config: kigi_tools::implementations::grok_build::web_fetch::WebFetchConfig,
     image_gen_config: kigi_tools::implementations::grok_build::image_gen::ImageGenConfig,
     video_gen_config: kigi_tools::implementations::grok_build::video_gen::VideoGenConfig,
@@ -1744,7 +1730,7 @@ pub(crate) async fn spawn_session_on_thread(
                     session_client_identifier,
                     inference_idle_timeout_secs,
                     max_retries,
-                    web_search_sampling_config,
+                    web_search_config,
                     web_fetch_config,
                     image_gen_config,
                     video_gen_config,